Ransomware Protection and Restoration Solutions Glendale

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that represents an existential threat for businesses of all sizes unprepared for an attack. Multiple generations of crypto-ransomware such as Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for a long time and still cause harm. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, as well as frequent as yet unnamed newcomers, not only perform encryption of online data files but also infiltrate many configured system backups. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a vulnerable environment, it can render automated restoration impossible and basically sets the entire system back to zero.

Getting back online applications and information following a ransomware event becomes a race against the clock as the victim struggles to stop the spread, cleanup the virus, and restore mission-critical activity. Due to the fact that crypto-ransomware needs time to replicate across a network, attacks are usually sprung on weekends, when successful attacks may take longer to detect. This compounds the difficulty of rapidly mobilizing and orchestrating a qualified mitigation team.

Progent provides a variety of support services for protecting Glendale enterprises from crypto-ransomware penetrations. Among these are team member training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to detect and disable day-zero malware assaults. Progent also can provide the assistance of seasoned ransomware recovery consultants with the talent and perseverance to rebuild a compromised network as quickly as possible.

Progent's Ransomware Recovery Help
After a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not guarantee that merciless criminals will respond with the needed keys to unencrypt all your files. Kaspersky determined that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to re-install the key parts of your IT environment. Absent the availability of complete system backups, this calls for a broad range of skill sets, well-coordinated team management, and the ability to work non-stop until the recovery project is finished.

For two decades, Progent has offered expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded high-level certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of expertise gives Progent the ability to rapidly determine important systems and organize the surviving components of your IT environment after a crypto-ransomware attack and configure them into a functioning network.

Progent's ransomware group has best of breed project management applications to orchestrate the complex recovery process. Progent appreciates the importance of working swiftly and together with a customer's management and Information Technology team members to prioritize tasks and to put essential systems back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A client contacted Progent after their organization was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean state cybercriminals, possibly using technology exposed from America's NSA organization. Ryuk targets specific companies with little room for disruption and is among the most lucrative iterations of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer based in the Chicago metro area with around 500 workers. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the start of the intrusion and were damaged. The client was taking steps for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked with the client to quickly assess and assign priority to the critical systems that had to be restored in order to continue departmental operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then completed reinstallations and hard drive recovery of key applications. All Exchange Server ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Offline Folder Files) on user PCs and laptops in order to recover email data. A not too old off-line backup of the businesses accounting/ERP software made it possible to recover these vital programs back on-line. Although major work remained to recover completely from the Ryuk virus, the most important services were recovered rapidly:

Over the following month critical milestones in the restoration process were accomplished through close collaboration between Progent engineers and the customer:

• In-house web applications were restored with no loss of data.
• The MailStore Server containing more than four million archived emails was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100 percent functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A possible enterprise-killing disaster was dodged by results-oriented professionals, a wide range of technical expertise, and tight collaboration. Although in post mortem the ransomware virus attack described here could have been identified and disabled with modern security technology and best practices, staff training, and well designed security procedures for data backup and proper patching controls, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware incursion, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Glendale
For ransomware system recovery services in the Glendale metro area, phone Progent at 800-462-8800 or go to Contact Progent.